v4.22.3

boratanrikulu/gecitv4.22.3Sep 14, 2026by UlisesGascon

Upgrading?

AI Summary

This release updates the path-to-regexp dependency to fix a security vulnerability and introduces conditional revalidation for QUERY requests.

Key Highlights

  • Security fix: Updated path-to-regexp to 0.1.13 to fix CVE-2026-4867
  • Feature: Allow conditional revalidation for QUERY requests (v4)
  • Dependency update: Updated qs to version ~6.16.0
  • CI improvement: Added npm staged publication with dist-tag support

New Features

  • Conditional revalidation for QUERY requests (v4)

Full Release Notes

## What's Changed
* Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 by @baryman in https://github.com/expressjs/express/pull/7135
* feat: allow conditional revalidation for QUERY requests (v4) by @Cherry in https://github.com/expressjs/express/pull/7377
* deps: qs@~6.16.0 by @lazerg in https://github.com/expressjs/express/pull/7440
* ci: add npm staged publication with dist-tag support by @UlisesGascon in https://github.com/expressjs/express/pull/7465
* 4.22.3 by @UlisesGascon in https://github.com/expressjs/express/pull/7466

## New Contributors
* @baryman made their first contribution in https://github.com/expressjs/express/pull/7135
* @lazerg made their first contribution in https://github.com/expressjs/express/pull/7440

**Full Changelog**: https://github.com/expressjs/express/compare/v4.22.2...v4.22.3

Related Repositories